Re: Forensics on Palm Devices

From: Joseph D. Knape, CISSP (jknapeat_private)
Date: Tue Oct 02 2001 - 08:00:16 PDT

Next message: Mike Zanker: "Re[2]: Recovering data from a wiped HD"

Previous message: Eoghan Casey: "Re: Forensics on Palm Devices"
In reply to: Eoghan Casey: "Re: Forensics on Palm Devices"
Next in thread: Skip Carter: "Re: Forensics on Palm Devices"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Eoghan,

Take a look at http://www.atstake.com/research/tools/ballz.zip

It allows you to view and change registers on the processor. I think, with a
little work, it could be leveraged as a forensics tool...

cheers,
.joe

#include <disclaimer.h>
---
Joseph D. Knape, CISSP, CCSE, MCSE, CCNA
Senior Network Engineer, Security
Greenwich Technology Partners
Phone: (972) 342 5634

----- Original Message -----
From: "Eoghan Casey" <eoghan.caseyat_private>
To: "Shue David R Contr AFRL/IFGB" <David.Shueat_private>
Cc: <forensicsat_private>
Sent: Tuesday, October 02, 2001 9:34 AM
Subject: Re: Forensics on Palm Devices

> to capture all evidence. Extending this thought, has anyone come across
> tools that access the DragonBall processor directly to reach into Flash
> memory beyond what is accessible via the Palm API?
>
> Eoghan Casey
> Information Security Office
> Yale University
>



-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Mike Zanker: "Re[2]: Recovering data from a wiped HD"
Previous message: Eoghan Casey: "Re: Forensics on Palm Devices"
In reply to: Eoghan Casey: "Re: Forensics on Palm Devices"
Next in thread: Skip Carter: "Re: Forensics on Palm Devices"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Oct 02 2001 - 08:30:20 PDT